fideiltyprgw[.]click

This domain, fideiltyprgw.click, is identified as a credential phishing site designed to impersonate the legitimate Fidelity NetBenefits login portal. The page title, 'Log In to Fidelity NetBenefits,' directly mimics the authentic platform, targeting users of financial services with the intent to harvest login credentials. No explicit drainer kit signatures were observed in initial analysis, though the infrastructure aligns with common phishing-as-a-service frameworks. The domain exhibits characteristics typical of large-scale phishing campaigns, including the use of a spoofed brand and a recently registered domain to evade reputation-based defenses. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 43.162.109.164, hosted within AS132203 (Tencent Building, Kejizhongyi Avenue), a network frequently associated with malicious activity. The domain was registered on November 13, 2025, through Gname.com Pte. Ltd., an offshore registrar commonly utilized for short-lived phishing domains. Detection metrics indicate a VirusTotal score of 17/95 security vendors flagging the domain as malicious. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, and is currently offline, suggesting takedown efforts or voluntary suspension by the threat actor. The SSL certificate, identified as 'E8,' provides no additional trust indicators, as it is likely self-signed or issued by a low-reputation certificate authority. Current status confirms the domain has been taken offline, though the infrastructure remains a residual risk. The IP address and registrar association may facilitate the rapid redeployment of similar phishing domains under different names. Users who interacted with the site prior to its takedown are advised to rotate credentials immediately, particularly for financial accounts, and monitor for unauthorized transactions. Organizations should update internal blocklists to include the domain and IP address, while security teams may investigate related indicators of compromise within their networks. The elevated risk level persists due to the domain's recent registration and the potential for threat actors to reuse the underlying infrastructure for future campaigns.